{"id":4013,"date":"2018-10-19T12:08:51","date_gmt":"2018-10-19T12:08:51","guid":{"rendered":"https:\/\/dbtut.com\/?p=4013"},"modified":"2018-11-26T19:12:26","modified_gmt":"2018-11-26T19:12:26","slug":"new-audit-mechanism-on-oracle-12c-unified-auditing","status":"publish","type":"post","link":"https:\/\/dbtut.com\/index.php\/2018\/10\/19\/new-audit-mechanism-on-oracle-12c-unified-auditing\/","title":{"rendered":"New Audit Mechanism on Oracle 12c : Unified Auditing"},"content":{"rendered":"
<\/p>\n
Hello everyone, Today I want to talk about new auditing features on Oracle 12c. As you know in Oracle 11g and below versions there were two audit mechanism:<\/p>\n
\n
Fine grain auditing<\/li>\n
Default audit mechanism<\/li>\n<\/ul>\n
In Traditional Oracle Database audit records are written to AUD$<\/em>, In FGA , audit records are written to\u00a0 FGA_LOG$<\/em> table, SYS log auditing is written to the Oracle Home location. If you need an anlalyse you need to correlate all of these sources. In 12c new properties added to Oracle Auditing. All audit records are written to the unified audit trail in a uniform format and are made available through the UNIFIED_AUDIT_TRAIL<\/em> view.These records reside in the AUDSYS schema. The audit records are stored in the SYSAUX tablespace by default.<\/p>\n
If you use pure unified auditing, the unified audit trail captures audit information from a variety of sources.These sources are:<\/p>\n
\n
Audit records (including SYS audit records) from unified audit policies and AUDIT settings<\/li>\n
Fine-grained audit records from the DBMS_FGA PL\/SQL package<\/li>\n
Oracle Database Real Application Security audit records<\/li>\n
Oracle Recovery Manager audit records<\/li>\n
Oracle Database Vault audit records<\/li>\n
Oracle Label Security audit records<\/li>\n
Oracle Data Mining records<\/li>\n
Oracle Data Pump<\/li>\n
Oracle SQL*Loader Direct Load<\/li>\n<\/ul>\n
The audit records, including records from the SYS audit trail, for all the audited components of your Oracle Database installation are placed in one location and in one format.<\/p>\n
<\/h3>\n
Auditing Mode of the database<\/h3>\n
There are two modes: Pure Unified auditing and Mixed mode.\u00a0The default mode in a new installed database is Mixed mode. In mixed mode both the traditional audit and new audit facilities are used.<\/p>\n
For checking if our database has migrated to Unified Auditing, query the v$option view:<\/p>\n
SELECT VALUE FROM V$OPTION WHERE PARAMETER = 'Unified Auditing';\r\n\r\nPARAMETER VALUE\r\n---------------- ----------\r\nUnified Auditing TRUE<\/pre>\n
If the value is True, it means that the database unified audit mechanism has activated. And database is using the pure Unified Auditing. \nIf the value is false, it means that the database uses mixed mode auditing.<\/p>\n
<\/h3>\n
Relinking unified auditing option<\/h3>\n
If the value is false and you want to use pure unified audit mechanism you need to relink the option:<\/p>\n
Shut down the database and the listener\r\n\r\ncd $ORACLE_HOME\/rdbms\/lib\r\nmake -f ins_rdbms.mk uniaud_on ioracle\r\n\r\nopen the listener and database<\/pre>\n
<\/h3>\n
Auditing policies<\/h3>\n
By default there are two enabled unified auditing policy. They are:<\/p>\n
One can query the enabled policies from AUDIT_UNIFIED_ENABLED_POLICIES<\/em> dictionary view. To start using unified auditing, you must enable at least one unified audit policy, and to stop using it, disable all unified audit policies. There are many disabled policies where can be seen from AUDIT_UNIFIED_POLICIES<\/em> dictionary view.<\/p>\n
In addition to these existing policies, you can configure unified auditing by creating custom unified audit policies or using fine-grained auditing. You can create policies that use conditions.<\/p>\n
<\/h4>\n
To create a new audit policy<\/strong>:<\/h4>\n
create audit policy up_hr actions update on hr.sales;<\/pre>\n
<\/p>\n
After creating the policy it must be enabled to start auditing:<\/strong><\/p>\n
audit policy up_hr;<\/pre>\n
<\/p>\n
For<\/strong> disabling the policy:<\/strong><\/p>\n
noaudit policy up_hr;<\/pre>\n
<\/h3>\n
Writing mode to the view<\/h3>\n
By default, Oracle Database writes unified audit records to system global area (SGA) queues. In other words, it writes the records periodically, not immediately. You can control how often the audit records are written. The audit data is written periodically to UNIFIED_AUDIT_TRAI<\/em>L view. So when you query this view you may not see the audit record immediately, because they are waiting in memory.<\/p>\n
You can purge periodically by createing a purge job.<\/p>\n
<\/h3>\n
Conclusion<\/h3>\n
As a conclusion unified audit mechanism provides easy access by consolidating all audit sources. Creating different policies provides flexibility. And the audit views are in AUDSYS schema and you can’t connect directly to this schema. \nIt increases the security of the audit sources.<\/p>\n\n